Hi! Has anyone tried openWrt with Zyxel GS2200 switches? They look pretty similar to the GS1900 ones, but I still haven't found out if they use the same hardware.
Try to dissect a fw file, if there are any available.
Could also try to read the serial console, or open it up, if the serial isn't accessible from outside.
@frollic thanks for your help. How would I "dissect" the firmware file? I can get the firmwares I need in
Biblioteca de downloads | Zyxel Networks
Ps.: I mistyped in the title, the switch is GS2220, not GS2200.
With binwalk
Ok, first time doing this. Does this help?
$ binwalk 470ABRP6C0.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
98114 0x17F42 ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
110412 0x1AF4C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/lzma/src/lzma.c
202004 0x31514 Unix path: /usr/share/tabset/vt100:\
202800 0x31830 bzip2 compressed data, block size = 100k
1775664 0x1B1830 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 33097676 bytes
2482101 0x25DFB5 gzip compressed data, ASCII, has header CRC, last modified: 2006-10-29 04:16:16
Use binwalk to extract the different parts on the image, then decompress the gzip and lzma compressed archives. Should give some idea of what os it is running
1 Like
After extracting, the following file seems interesting (trunkated to fit here). However, I lack any experience with this. If anyone can interpret this result, I will be very grateful.
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
20509592 0x138F398 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/threadx/threadx-mips34k-rtk839xM/src/sys_isrdep.c
20520860 0x1391F9C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/natcmd.c
20524216 0x1392CB8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/network.c
20525532 0x13931DC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/socket.c
20530268 0x139445C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/telnetd.c
20535848 0x1395A28 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/dnsproxy.c
20537156 0x1395F44 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/filter.c
20543632 0x1397890 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/icmpcmd.c
20546168 0x1398278 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/ip.c
20551476 0x1399734 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/iphdr.c
20552620 0x1399BAC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/iproute.c
20555548 0x139A71C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/natacl.c
20556820 0x139AC14 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/netdial.c
20559264 0x139B5A0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/select.c
20563828 0x139C774 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/inet/src/tftpload.c
20574252 0x139F02C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/dhcp-core/src/rpdhcp_api.c
20590116 0x13A2E24 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ip/dns/src/dns.c
20592748 0x13A386C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/ip6sg.c
20595168 0x13A41E0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/ip6Snp.c
20601876 0x13A5C14 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/socket6.c
20602108 0x13A5CFC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/zykame_rts.c
20602948 0x13A6044 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/ip6_bsdcmd.c
20607032 0x13A7038 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/ip6_cmd.c
20612574 0x13A85DE Neighborly text, "neighbor.CT"
20612752 0x13A8690 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/ipv6/ipv6/src/ip6Cache.c
20613384 0x13A8908 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/layer-3/preroutesnp/src/preRouteSnpHandler.c
20614156 0x13A8C0C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/layer-3/static-arp/src/ipCache.c
20615008 0x13A8F60 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/httpd/src/httpd.c
20618020 0x13A9B24 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/httpd/src/stcp.c
20619608 0x13AA158 HTML document header
20619616 0x13AA160 HTML document footer
20623496 0x13AB088 Base64 standard index table
20626676 0x13ABCF4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/clmgr/src/clusterM.c
20631100 0x13ACE3C Neighborly text, "Neighbor debug level: %s"
20631139 0x13ACE63 Neighborly text, "Neighbor debug level: %svel <level|all>"
20631185 0x13ACE91 Neighborly text, "neighbor debug level <level|all>"
20631420 0x13ACF7C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/zon/src/zonWrapperTxRx.c
20632292 0x13AD2E4 Neighborly text, "Neighbor Debug Level:---------------------------------"
20632405 0x13AD355 Neighborly text, "Neighbor Debug Level:oDefault"
20632444 0x13AD37C Neighborly text, "NeighborMgmtResetConfigToDefaultme/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/zon/src/zonNeighborMgmtApi.c"
20632504 0x13AD3B8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/zon/src/zonNeighborMgmtApi.c
20632563 0x13AD3F3 Neighborly text, "NeighborMgmtApi.cd"
20632639 0x13AD43F Neighborly text, "NeighborMgmtResetConfigToDefaultToDefault"
20632679 0x13AD467 Neighborly text, "NeighborMgmtResetConfigToDefault %d"
20632751 0x13AD4AF Neighborly text, "NeighborMgmtRemMibDeleteAllId %d zon structure "
20632883 0x13AD533 Neighborly text, "NeighborMgmtRemMibSearchist)"
20633143 0x13AD637 Neighborly text, "NeighborMgmtResetConfigToDefaultPacketSendd), retransmit = %d"
20633286 0x13AD6C6 Neighborly text, "NeighborMgmtResetConfigToDefaulttime %d ms"
20633370 0x13AD71A Neighborly text, "NeighborMgmtResetConfigToDefault 5 seconds Enable portId = %d(0-based)"
20633482 0x13AD78A Neighborly text, "NeighborMgmtRecycle %d ms"
20633562 0x13AD7DA Neighborly text, "NeighborMgmtRecycleIpv4AddressNetmaskSet"
20637684 0x13AE7F4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/mgnt/zon/src/zonWrapperApi.c
20664976 0x13B5290 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/multicast/mldsnppxy/src/mldsnppxy_packet.c
20678870 0x13B88D6 ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
20690156 0x13BB4EC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/security/ieee-8021x/src/dot1x.c
20699908 0x13BDB04 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/security/mac-auth/src/macAuth.c
20705628 0x13BF15C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/security/aaa/src/aaaSvc.c
20724736 0x13C3C00 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/stacking/zystk/src/zystk.c
20730536 0x13C52A8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/stacking/zystk/src/zystkCardManager.c
20738062 0x13C700E Neighborly text, "neighbor mac = %02x:%02x:%02x:%02x:%02x:%02xing slot %d stacking channel %d is up "
20739596 0x13C760C Neighborly text, "neighbor channel conflictk "
20739910 0x13C7746 Neighborly text, "neighbor %02x:%02x:%02x:%02x:%02x:%02x channel_%d, port %d neighbor %02x:%02x:%02x:%02x:%02x:%02x channel_%dhbor %02x:%02x:%02x:%02x:%02x:%02x channel_%d"
20739969 0x13C7781 Neighborly text, "neighbor %02x:%02x:%02x:%02x:%02x:%02x channel_%dacket process error code =%d event send error =%d"
20742844 0x13C82BC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/stacking/zystk/src/zystkTopologyHandler.c
20744473 0x13C8919 Neighborly text, "neighbor stacking channel index pbm"
20744616 0x13C89A8 Neighborly text, "neighbor_flag = %dit_count = %d"
20744734 0x13C8A1E Neighborly text, "neighbor channel index = %dn:"
20745066 0x13C8B6A Neighborly text, "neighbor mac = s entry number =%d"
20745098 0x13C8B8A Neighborly text, "neighbor stack channel = %d result"
20745486 0x13C8D0E Neighborly text, "neighbor info result:bor info[1]"
20745524 0x13C8D34 Neighborly text, "neighbor info[0]15s%-15s%-20s"
20745544 0x13C8D48 Neighborly text, "neighbor info[1]nnel idx"
20754237 0x13CAF3D Neighborly text, "Neighbor Stacking Slot %d Information"
20757928 0x13CBDA8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/main/src/bmitfarm.c
20758006 0x13CBDF6 ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16
20758104 0x13CBE58 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/main/src/rasmain.c
20758548 0x13CC014 Copyright string: "Copyright (c) %d Zyxel and/or its affiliates. All Rights Reserved."
20758812 0x13CC11C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/appCmd_api.c
20759408 0x13CC370 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/bootmod.c
20760034 0x13CC5E2 ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 29556, uncompressed size: 29561, data offset from start of block: 25981
20761680 0x13CCC50 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/carddb.c
20762260 0x13CCE94 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/cbuf.c
20763804 0x13CD49C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/cli_util.c
20765532 0x13CDB5C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/cmdparse.c
20766532 0x13CDF44 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/cpuload.c
20768510 0x13CE6FE Neighborly text, "neighbor loss adslAtucPerfLofsThresh"
20770788 0x13CEFE4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/errorlog.c
20771796 0x13CF3D4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/event.c
20772048 0x13CF4D0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/evnt_cmd.c
20773152 0x13CF920 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/genFS.c
20776158 0x13D04DE OpenSSH RSA public key
20776218 0x13D051A OpenSSH RSA public key
20780979 0x13D17B3 Neighborly text, "neighbor debug level: %s: %s"
20781022 0x13D17DE Neighborly text, "neighbor debug level: %sch neigbhor debug level <level|all>"
20781750 0x13D1AB6 Neighborly text, "Neighbor"
20786540 0x13D2D6C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/hugememory.c
20787164 0x13D2FDC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/ioctl.c
20789844 0x13D3A54 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/mbuf.c
20790192 0x13D3BB0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/mbuflink.c
20791000 0x13D3ED8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/mbuf_mgr.c
20792752 0x13D45B0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/ol_main.c
20793144 0x13D4738 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/qrm.c
20795208 0x13D4F48 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/rassys.c
20796858 0x13D55BA ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16
20797216 0x13D5720 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/romfile.c
20797818 0x13D597A ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
20798622 0x13D5C9E ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 26996, uncompressed size: 18798, data offset from start of block: 26993
20800020 0x13D6214 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/servd.c
20801912 0x13D6978 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/stdio.c
20810226 0x13D89F2 ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 25205, uncompressed size: 25701, data offset from start of block: 26384
20818696 0x13DAB08 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_confext.c
20821080 0x13DB458 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_data.c
20821348 0x13DB564 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_fid.c
20821472 0x13DB5E0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_isr.c
20822004 0x13DB7F4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_mem.c
20823916 0x13DBF6C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_proc.c
20826120 0x13DC808 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_reg.c
20828836 0x13DD2A4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_util.c
20829300 0x13DD474 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/sys_wdg.c
20830232 0x13DD818 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/timer.c
20831272 0x13DDC28 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/tracelog.c
20831882 0x13DDE8A ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 24932, uncompressed size: 29285, data offset from start of block: 17522
20834860 0x13DEA2C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/core/src/mpqlm2.c
20837148 0x13DF31C Neighborly text, "Neighbor Solicitatione"
20837172 0x13DF334 Neighborly text, "Neighbor Advertisement"
20837304 0x13DF3B8 Neighborly text, "Neighbor Discovery Solicitation Messageery Advertisement Message"
20837352 0x13DF3E8 Neighborly text, "Neighbor Discovery Advertisement Message Listener Report"
20848180 0x13E1E34 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt.c
20848676 0x13E2024 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt_enet.c
20851648 0x13E2BC0 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt_ip.c
20852468 0x13E2EF4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt_rn.c
20853086 0x13E315E ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 29552, uncompressed size: 0, data offset from start of block: 29761
20858584 0x13E46D8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/sptinit.c
20860208 0x13E4D30 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/sptnat.c
20861124 0x13E50C4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt_fs.c
20862452 0x13E55F4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/spt/src/spt_swp.c
20864788 0x13E5F14 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/res_mgr/src/channel.c
20866096 0x13E6430 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/res_mgr/src/rm_chann.c
20866424 0x13E6578 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/res_mgr/src/rm_iface.c
20866860 0x13E672C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/ndis/src/ndis_cal.c
20867068 0x13E67FC Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/ndis/src/ndislib.c
20868376 0x13E6D18 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/ndis/src/ndis_mtn.c
20868668 0x13E6E3C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/ndis/src/ndis_reg.c
20870936 0x13E7718 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/ndis/src/ndis_scr.c
20871288 0x13E7878 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_cmd.c
20872220 0x13E7C1C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_drv.c
20872816 0x13E7E70 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_itf.c
20873428 0x13E80D4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enetmain.c
20874196 0x13E83D4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_mtn.c
20874816 0x13E8640 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_pkt.c
20875916 0x13E8A8C Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/enet/src/enet_tst.c
20876839 0x13E8E27 Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
20879804 0x13E99BC CRC32 polynomial table, big endian
20883623 0x13EA8A7 Copyright string: "Copyright 1995-2005 Mark Adler "
20884288 0x13EAB40 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/sw-api/src/sw_api.c
20886600 0x13EB448 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/sw-api/src/sw_drv.c
20888420 0x13EBB64 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/sw-api/src/sw_main.c
20888932 0x13EBD64 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/sw-api/src/sw_pkt.c
20889380 0x13EBF24 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/sw-api/src/sw_stp.c
20962772 0x13FDDD4 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/l2-common/src/cliVlanCmd.c
20964324 0x13FE3E4 PEM RSA private key
20964460 0x13FE46C PEM certificate
20964952 0x13FE658 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/l2-common/src/customCA.c
20970318 0x13FFB4E Neighborly text, "neighbortable.htmlml"
20974989 0x1400D8D Neighborly text, "Neighbor TableConfigure Clone"
20977550 0x140178E Neighborly text, "Neighbor Status Error.or."
20989331 0x1404593 Neighborly text, "neighbor number exceeds maximum! conflicting!"
20989383 0x14045C7 Neighborly text, "neighbor is conflicting!C Aging Time should be from 10 to 1000000."
20994103 0x1405837 Neighborly text, "neighbor entry is maximum"
20994150 0x1405866 Neighborly text, "neighbor failed static neighbor failed"
20994175 0x140587F Neighborly text, "Neighbor is not exist"
20994221 0x14058AD Neighborly text, "neighbor failedid ipv6 prefix"
20994575 0x1405A0F Neighborly text, "neighbor addressdress is not unique"
20994627 0x1405A43 Neighborly text, "Neighbor address is not unique The specified interface does not exist"
21008040 0x1408EA8 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/l2-common/src/rpswitch_api.c
21008176 0x1408F30 Copyright string: "Copyright © %d Zyxel and/or its affiliates. All Rights Reserved."
21010548 0x1409874 Unix path: /home/julian/470-GS2220/470-GS2220-FCS6-b3/system/l2-common/src/rpvlan1q_api.c
21023364 0x140CA84 Neighborly text, "Neighbor_SystemName"
[...]
I discovered this thread just now - this looks similar (not identical) to the GS1920 firmware file format I'm currently trying to understand. See if some info from this thread helps: Support for Zyxel GS1920 series (GS1920-24HP)
And you have references to ThreadX and RTL839x, so this is not running Linux but based on an RTL839x platform - again, seems similar to the GS1920 series.